Cursor marketplace backdoor tests trust in AI coding assistants

Cursor removed a compromised Claude Code extension from its marketplace on October 29. This came after researchers found out that the malicious extensions installed an SSH backdoor. An estimated 5,000 users may have been affected. The issue did not involve Anthropic’s AI model, Claude. Instead, the malware became available to developers through Cursor’s extension marketplace.

Two poisoned builds slipped in for eleven hours

Two compromised versions of Anthropic.claude-code, 2.1.312 and 2.1.313, were made available for download on Cursor’s marketplace for Windows and macOS. They remained available for about eleven hours on October 29, from 2:27 a.m. to 1:35 p.m. Pacific time, according to Cursor’s notice.

Anthropic did not create either malicious plug-in. OpenSourceMalware examined version 2.1.313 and found that the official npm package, Open VSX listing and Microsoft VS Code Marketplace version were unaffected.

A backdoor prepended before the real extension

The attacker hid a 66-line loader at the start of the extension’s JavaScript file. This meant the malicious code ran before the legitimate extension. As OpenSourceMalware explained:

The user doesn’t need to begin a Claude conversation. Loading the extension module is enough.

Upon activation, the code was able to collect information about the computer along with the types of credentials which are present on it. It also generated a svc-telemetry SSH key and attempted to create a reverse tunnel to 134.209.82.225. At the same, it sent out the data about the computer via HTTP using port 8099.

Cursor claims that attempts to use SSH were typically unsuccessful without admin privileges. Even so, the spyware key and persistence scripts can remain on the computer. The code could continue gathering and transmitting information about the computer.

Why uninstalling may not be enough

Cursor removed the malware and temporarily shut down its marketplace. It also checked other extensions and worked with the hosting provider to take the attacker’s server offline. But that didn’t mean affected computers were safe. Cursor warned in its security guidance that:

“Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running.”

Examples of those persistence scripts are LaunchAgent on macOS and a scheduled task on Windows. Cursor advised affected developers to delete the svc-telemetry SSH key and to run the company’s cleanup scripts. The developers must use a separate trusted device to change the credentials they have access to from the affected computer.

Why this fits a 2026 pattern

The Cursor incident is part of a bigger problem. Attackers are targeting more and more the tools that developers use and trust. Cloud Security Alliance reported about the TrapDoor campaign, which involved over 34 malicious packages that inserted hidden instructions in AI-assistant configuration files.

Meanwhile, the GlassWorm campaign used sleeper extensions to target credentials and crypto wallets of developers. Cryptopolitan previously reported about 73 such extensions identified by Socket.

The problem goes beyond extensions. Sonatype identified more than 454,600 new malicious packages in 2025. Cryptopolitan also covered its findings on poisoned npm libraries. These were separate attacks, with no confirmed links between their perpetrators.

Trust becomes a line item in enterprise contracts

The growing threat is evident as the use of AI tools among developers increases. GitHub’s Octoverse says developers’ activities have risen because AI systems are gaining popularity.

According to the Stack Overflow survey conducted in 2026, when asked about their use of AI tools, 80% of the respondents stated that they use it for an hour per day or more. However, the survey also showed that 48% of the respondents trust the content generated by AI only if its validity is easy to confirm.

For businesses, the growing use of AI tools brings new security concerns. Companies may start demanding stronger marketplace checks, proof that extensions come from legitimate sources and tighter access controls. They may also expect vendors to respond faster when security breaches occur.

These security measures could be yet another cost of implementing AI tools. However, these are costs that are still potential rather than actual financial losses from the Cursor incident.